CWE-502: Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
Also known as Marshaling/Marshalling, Unmarshaling/Unmarshalling, Pickling, Unpickling, PHP Object Injection.
A kind of CWE-913 Improper Control of Dynamically-Managed Code Resources.
From the CWE List. © The MITRE Corporation.
Newest
- apache camel, apache software foundation camel leveldb, red hat build of apache camel for spring boot 4 +3 more +5 moreApache Camel LevelDB: Deserialization of Untrusted Data in Camel LevelDB8.8 High
- datapizza ai, datapizza-labs datapizza-ai +1 moredatapizza-labs datapizza-ai cache.py RedisCache deserialization2.1 Low
- funadminfunadmin Backend Endpoint AuthCloudService.php getMember deserialization5.1 Medium
- gfi archiverGFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- gfi archiverGFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability8.8 High
- it-novum openitcockpitopenITCOCKPIT has Unsafe Deserialization in openITCOCKPIT Changelog Handling7.5 High
- it-novum openitcockpitopenITCOCKPIT has Unsafe PHP Deserialization in Gearman Worker Allowing Conditional Object Injection7.5 High
- leafcolor applay - shortcodesWordPress Applay - Shortcodes plugin <= 3.7 - PHP Object Injection vulnerability9.8 Critical
- dotstore woocommerce category banner managementWordPress Woocommerce Category Banner Management plugin <= 2.5.1 - PHP Object Injection vulnerability8.8 High
- a wp life slider responsive slideshow – image slider, gallery slideshowWordPress Slider Responsive Slideshow – Image slider, Gallery slideshow plugin <= 1.5.4 - PHP Object Injection vulnerability8.8 High
- a wp life image gallery – lightbox gallery, responsive photo gallery, masonry galleryWordPress Image Gallery – Lightbox Gallery, Responsive Photo Gallery, Masonry Gallery plugin <= 1.6.0 - PHP Object Injection vulnerability8.8 High
- themerex lorem ipsum | books & media storeWordPress Lorem Ipsum | Books & Media Store theme <= 1.2.11 - PHP Object Injection vulnerability9.8 Critical
- themerex extreme storeWordPress Extreme Store theme <= 1.5.10 - PHP Object Injection vulnerability9.8 Critical
- themesflat elementorWordPress Themesflat Elementor plugin <= 1.0.1 - PHP Object Injection vulnerability9.8 Critical
- ancorathemes sevenhillsWordPress SevenHills theme <= 1.6.2 - PHP Object Injection vulnerability9.8 Critical
- ancorathemes kindlycareWordPress KindlyCare theme <= 1.6.1 - PHP Object Injection vulnerability9.8 Critical
- themegoods capellaWordPress Capella theme <= 2.5.5 - PHP Object Injection vulnerability9.8 Critical
- jthemes prestigeWordPress Prestige theme < 1.4.1 - PHP Object Injection vulnerability9.8 Critical
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.5.9 - PHP Object Injection vulnerability8.8 High
- themegoods photomeWordPress PhotoMe theme <= 5.6.11 - PHP Object Injection vulnerability9.8 Critical
- fuelthemes peakshopsWordPress PeakShops theme <= 1.5.9 - PHP Object Injection vulnerability8.8 High
- kleor contact managerWordPress Contact Manager plugin <= 9.1.1 - PHP Object Injection vulnerability8.8 High
- boldthemes ippsumWordPress Ippsum theme <= 1.2.0 - PHP Object Injection vulnerability9.8 Critical
- modeltheme addons for wpbakery and elementorWordPress ModelTheme Addons for WPBakery and Elementor plugin < 1.5.6 - PHP Object Injection vulnerability8.8 High
- a wp life modal popup boxWordPress Modal Popup Box plugin <= 1.6.1 - PHP Object Injection vulnerability8.8 High
- boldthemes traveliciousWordPress Travelicious theme < 1.6.7 - PHP Object Injection vulnerability9.8 Critical
- boldthemes nestinWordPress Nestin theme < 1.2.6 - PHP Object Injection vulnerability9.8 Critical
- loftocean patiotimeWordPress PatioTime theme < 2.1 - PHP Object Injection vulnerability9.8 Critical
- zumba json-serializerZumba Json Serializer has a potential PHP Object Injection via Unrestricted @type in unserialize()8.1 High
- spipSPIP < 4.4.9 Insecure Deserialization9.2 Critical
- brainstorm force cartflowsWordPress CartFlows plugin <= 2.1.19 - PHP Object Injection vulnerability7.2 High
- magepeopleteam wpeventlyWordPress WpEvently plugin <= 5.1.1 - PHP Object Injection vulnerability9.8 Critical
- codetipi valentiWordPress Valenti theme <= 5.6.3.5 - PHP Object Injection vulnerability8.8 High
- themegoods grand restaurantWordPress Grand Restaurant theme <= 7.0.10 - PHP Object Injection vulnerability9.8 Critical
- yith woocommerce compare, yithemes yith woocommerce compare +1 moreWordPress YITH WooCommerce Compare plugin <= 3.6.0 - Deserialization of untrusted data vulnerability7.2 High
- opentext™ directory servicesAn Insecure Deserialization vulnerability has been discovered in OpenText™ Directory Services.9.5 Critical
- berocket advanced ajax product filtersAdvanced AJAX Product Filters <= 3.1.9.6 - Authenticated (Author+) PHP Object Injection via Live Composer Compatibility8.8 High
- bosch rexroth indraworks, bosch rexroth indraworks +1 moreA vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to...7.8 High
- bosch rexroth indraworks, bosch rexroth indraworks +1 moreA vulnerability has been identified in Rexroth IndraWorks. This flaw allows an attacker to...7.8 High
- bosch rexroth indraworks, bosch rexroth indraworks, ua.testclient +1 more +3 moreA vulnerability has been identified in the UA.Testclient utility, which is included in Rexroth...7.8 High
- bosch rexroth indraworks, bosch rexroth indraworks +1 moreA vulnerability has been identified in the OPC.Testclient utility, which is included in Rexroth...7.8 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework Deserializes Untrusted Data7.8 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code...7.8 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework contains a vulnerability where malicious data could cause remote code execution8.0 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code...7.8 High
- nvidia nemo, nemo framework +1 moreNVIDIA NeMo Framework contains a vulnerability where an attacker could cause remote code...7.8 High
- modeltc lightllmLightLLM <= 1.1.0 PD Mode Unsafe Deserialization RCE9.3 Critical
- jeecg bootJeecgBoot Retrieval-Augmented Generation AiragKnowledgeController.java importDocumentFromZip deserialization2.3 Low
- calero verasmartCalero VeraSMART < 2022 R1 .NET Remoting Arbitrary File Read Leading to ViewState RCE10.0 Critical
- alex4ssb adb-explorerADB Explorer Vulnerable to Remote Code Execution via Insecure Deserialization7.8 High
- Show moreLoading…